Getting Started

Requirements

  • Java 21 or higher
  • Paper 1.21.1+ (or Folia)
  • XCore (required — install it first)

Installation

  1. Make sure XCore is installed and running on your server.
  2. Download XLogin from BuiltByBit and place the JAR in /plugins/XCore/addons/.
  3. Start the server — XLogin will generate its config files in /plugins/XCore/addons/XLogin/.
  4. Edit config.yml and lang.yml to your needs.
  5. Restart or run /xlogin reload.

Feature Overview

XLogin is organized into several major systems:

  • Authentication — Login, register, change password with session management and configurable timeouts.
  • Premium Auto-Login — Per-player online-mode via Netty pipeline injection. Premium players connect with their real Mojang skin, no /login needed. Cracked players using a premium name are automatically rejected.
  • Two-Factor Authentication — TOTP support compatible with Google Authenticator, Authy, Microsoft Authenticator, etc.
  • Cross-Server Sessions — Database-backed sessions shared across all servers. Login once, authenticated everywhere.
  • Proxy Support — Role-based server configuration (AUTH, LOBBY, GAME) with automatic player routing for BungeeCord/Velocity networks.
  • Bedrock Auto-Login — Automatic authentication for Geyser/Floodgate players.
  • Email Recovery — Players can link an email and use it to recover their password via a 6-digit code sent by SMTP.
  • UUID Modes — OFFLINE (default, all players use offline UUIDs) or REAL (premium players get their Mojang UUID for cosmetics on Lunar/Badlion).
  • Security — IP rate limiting, temporary IP bans, IP lock, brute-force protection, password strength requirements, name validation.
  • Player Restrictions — Movement, chat, interactions, inventory, vehicles, portals, and teleportation are all blocked until authenticated.
Configuration